Malicious PDF — malware analysis report

Static analysis result for SHA-256 426afc1a9acae68c…

MALICIOUS

PDF

17.1 KB Created: 2020-03-18 11:21:59 +00:00 Authoring application: mPDF 5.7
MD5: 4e6b03bf6a442f472212e9c4aab45765 SHA-1: e65fcbf973290e6e285e016d814110682811b55d SHA-256: 426afc1a9acae68cdbfd3746c91796923e87d684f08f465e05089c3b495230ce
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' confirms this behavior, indicating a likely attempt to drive traffic to a domain hosting numerous book-related PDFs. No scripts were extracted from this sample, and the document body was unreadable, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lwoscmobook.myhome.cx/252425249524452415245/Nolan-Trilogy-Box-Set-Under-Mr-Nolan-s-Bed-1-3-by-Selena-Kitt.pdf
    • http://lwoscmobook.myhome.cx/35247524252425241/Nolan-on-Bradbury-by-William-F-Nolan.pdf
    • http://lwoscmobook.myhome.cx/452445249524452465240/Under-Mr-Nolan-s-Bed-Under-Mr-Nolan-s-Bed-1-by-Selena-Kitt.pdf
    • http://lwoscmobook.myhome.cx/252405247524752405247/Mated-to-the-Vampire-Kings-A-Baby-For-the-Kings-The-Chosen-2-by-Charlene-Hartnady.pdf
    • http://lwoscmobook.myhome.cx/352485248524852455249/Gods-and-Kings-Chronicles-of-the-Kings-1-by-Lynn-Austin.pdf
    • http://lwoscmobook.myhome.cx/1524152445248524252455248/Ed-Sheeran-The-Biography-David-Nolan-by-David-Nolan.pdf
    • http://lwoscmobook.myhome.cx/452425247524252475242/Miracle-Man-Nolan-Ryan-The-Autobiography-by-Nolan-Ryan.pdf
    • http://lwoscmobook.myhome.cx/1524052495245524152475242/Kin-of-Kings-The-Kin-of-Kings-1-by-B-T-Narro.pdf
    • http://lwoscmobook.myhome.cx/3524252415241/Summer-Days-and-Summer-Nights-Twelve-Love-Stories-by-Stephanie-Perkins.pdf
    • http://lwoscmobook.myhome.cx/452405244524552455248/Summer-Angel-Summer-Spirit-Novellas-1-by-Samantha-Jacobey.pdf
    • http://lwoscmobook.myhome.cx/1524052415241524852455244/The-Paleo-Summer-Survival-Guide-12-Must-Have-Recipes-Plus-Insider-Tips-for-a-Healthy-Happy-Summer-by-Julie-Mayfield.pdf
    • http://lwoscmobook.myhome.cx/1524152445243524552415249/Summer-s-Child-amp-Summer-of-Roses-by-Luanne-Rice.pdf
    • http://lwoscmobook.myhome.cx/952425245/The-Summer-s-End-Lowcountry-Summer-3-by-Mary-Alice-Monroe.pdf
    • http://lwoscmobook.myhome.cx/1524152445240524552405249/Summer-of-Hope-Summer-of-Dreams-by-Steven-Recht.pdf
    • http://lwoscmobook.myhome.cx/152445247524252405244/That-Summer-Part-Two-That-Summer-2-by-Lauren-Crossley.pdf
    • http://lwoscmobook.myhome.cx/452495240524152475245/The-Summer-of-Sneaking-Out-Summer-2-by-Amanda-Howells.pdf
    • http://lwoscmobook.myhome.cx/152485240524452485245/Since-Last-Summer-Rules-of-Summer-2-by-Joanna-Philbin.pdf
    • http://lwoscmobook.myhome.cx/35243524052435248/The-Summer-I-Turned-Pretty-Summer-1-by-Jenny-Han.pdf
    • http://lwoscmobook.myhome.cx/452415246524152455245/That-Summer-Part-Two-That-Summer-2-by-Lauren-Crossley.pdf
    • http://lwoscmobook.myhome.cx/1524052415248524252415243/Summer-Morning-Summer-Night-by-Ray-Bradbury.pdf
    • http://lwoscmobook.myhome.cx/3524252415241/Summer-Days-and-Summer-Nights-Twelve-Love-

Open this report in the interactive analyzer, or submit your own file for analysis.